Firewall packet matching optimization using network traffic behavior and packet matching statistics

Zouheir Trabelsi, Hishem El Sayed, Safaa Zeidan

Research output: Chapter in Book/Report/Conference proceedingConference contribution

1 Citation (Scopus)

Abstract

In this paper, we present a mechanism that utilizes network traffic behavior and packet matching statistics to optimize dynamically the ordering of the firewall filtering rules. The proposed technique segments the traffic space, calculates the matching rate for each filtering rule and deduces statistics means and variances over a predefined window of segments. The means and variances are used to update the positions of the filtering rules in the security policy. Through experiments using simulated firewall and network traffic generator, the proposed mechanism is shown to be efficient and easy to deploy in practical firewall implementation. This work demonstrates that the use of dynamic rule-ordering improves the filtering processing time and allows firewall administrators to analyze further the network traffic behavior and accordingly adjust the initial order of the filtering rules.

Original languageEnglish
Title of host publication3rd International Conference on Communications and Networking, ComNet 2012
DOIs
Publication statusPublished - 2012
Event2012 3rd International Conference on Communications and Networking, ComNet 2012 - Hammamet, Tunisia
Duration: Mar 29 2012Apr 1 2012

Publication series

Name3rd International Conference on Communications and Networking, ComNet 2012

Other

Other2012 3rd International Conference on Communications and Networking, ComNet 2012
Country/TerritoryTunisia
CityHammamet
Period3/29/124/1/12

Keywords

  • Firewall
  • dynamic rule ordering
  • filtering rules

ASJC Scopus subject areas

  • Electrical and Electronic Engineering

Fingerprint

Dive into the research topics of 'Firewall packet matching optimization using network traffic behavior and packet matching statistics'. Together they form a unique fingerprint.

Cite this